[yakupyigit]

Summary

Adds complete S3-compatible bucket support to the backup system, allowing snapshots to be stored in AWS S3, Cloudflare R2, Backblaze B2, MinIO, or any other S3-compatible service alongside or instead of local targets.

Key Changes

• New S3 target implementation (src/targets/s3.ts):

  • Full S3 operations: upload with multipart streaming, list with pagination, delete with batching, and access verification
  • Credential handling with environment variable fallback (GHBACKUP_S3_*)
  • Comprehensive error masking to prevent credential leaks in error messages
  • Support for custom endpoints, regions, and path-style configuration
  • Cleanup of incomplete/orphaned multipart uploads

• Shared snapshot naming (src/targets/names.ts):

  • Extracted parseSnapshotName() utility used by both local and S3 targets to parse <stamp>.<ext> filenames

• Configuration and integration:

  • S3 target type added to config schema and factory (src/targets/index.ts)
  • Pre-backup access check for all targets to fail fast with clear errors (src/commands/backup.ts)
  • Updated README with S3 configuration examples and credential precedence rules

• Comprehensive test coverage:

  • Unit tests for S3 utilities, credential handling, error masking, and fake client scenarios
  • Integration tests against S3Proxy service container covering upload/download, pagination, retention, and credential validation
  • End-to-end backup tests verifying identical output to both local and S3 targets

• CI/CD setup:

  • S3Proxy service container in GitHub Actions with fixed test credentials
  • Environment variables to enable S3 integration tests in CI

Notable Implementation Details

• Multipart uploads use 16 MiB parts (supporting objects up to 160 GB)
• Deletion batches use 1000 keys per request (S3 API limit)
• Manifest (.json) is deleted first during snapshot removal to ensure incomplete snapshots are never considered valid
• Credentials from config file take precedence over GHBACKUP_S3_* environment variables, which fall back to SDK's default chain
• All S3 errors are wrapped with context (repository key, operation) and credentials are masked before surfacing to users
• Multipart upload listing failures are non-fatal (some S3-compatible services don't support it)

https://claude.ai/code/session_01EreR27QcUGyx3TeBypytVW